Skip to content

Back to the catalog

DataDog/pathfinding-labs
github.comrepo

DataDog/pathfinding-labs

Pathfinding Labs is DataDog's open-source platform (Go CLI 'plabs' + Terraform modules) for deploying intentionally vulnerable AWS resources into sandbox accounts to practice attacking and detecting IAM privilege-escalation paths. It ships modular labs across five categories — self-escalation, one-hop/multi-hop principal traversal, CSPM misconfigurations, toxic combos, and cross-account (dev/ops-to-prod) chains — each with demo/cleanup scripts, expected CSPM alerts, and MITRE ATT&CK mappings (e.g. T1098.001). It's positioned as a successor/companion to projects like IAM Vulnerable and Stratus Red Team for hands-on cloud identity attack training.

TL;DR DataDog's open-source, Terraform-driven lab platform for practicing AWS IAM privilege-escalation attacks and testing CSPM/detection tooling against them.
Open original ↗
Document

What it is

The operational detail behind Pathfinding Labs — installation paths, the plabs command workflow, and, most importantly, exactly what the tool creates in your AWS account. The summary tells you what the platform is for; this is what you need to know before pointing it at an account.

How it works

Each lab is a self-contained Terraform module toggled through the plabs CLI (a TUI dashboard, or enable/disable by lab ID). plabs apply deploys, plabs demo <id> runs the exploitation walkthrough, and cleanup tears artifacts down. Labs expose credentials via grouped Terraform outputs that demo scripts read automatically — no manual profile wiring. Most labs need only ONE AWS account and deploy to the prod profile; separate dev/ops profiles are required only for cross-account labs.

Preconditions / Affected

  • Go 1.25+ (for go install or source build).
  • AWS CLI configured with named profiles; sandbox/playground accounts only — the page repeats "never use production."
  • No existing resources are modified. Every created resource uses the pl- prefix for auditing.

What to do

Install via one of:

go install -v github.com/DataDog/pathfinding-labs/cmd/plabs@latest
brew tap DataDog/pathfinding-labs https://github.com/DataDog/pathfinding-labs
brew install DataDog/pathfinding-labs/plabs

Then run the setup wizard (downloads terraform, clones repo, configures profiles):

plabs init

Deploy and exercise a lab (verbatim example IDs iam-002-iam-createaccesskey, lambda-001-iam-passrole):

plabs enable iam-002-iam-createaccesskey
plabs apply
plabs demo iam-002-iam-createaccesskey
plabs cleanup iam-002-iam-createaccesskey

For CI/automation, set config directly instead of the wizard:

plabs config set prod-profile my-prod-profile
plabs config set prod-region us-east-1

Caveats

The blast radius is not zero even though nothing existing is touched. Each environment provisions an admin-level IAM user, pl-admin-user-for-cleanup-scripts, with broad permissions, existing solely so cleanup scripts can revert artifacts — a standing high-privilege principal in whatever account you deploy to. The simulated attacker foothold (starting user) is scoped to only sts:GetCallerIdentity and iam:GetUser, but the intentionally vulnerable IAM misconfigurations are, by design, real privilege-escalation paths. Treat any account running this as compromised-by-construction and isolated accordingly.

Organisations named here

  • Stratus Red Team
  • T1098.001

Technologies named here

  • Pathfinding Labs
  • AWS
  • AWS CLI
  • Terraform
  • IAM Identity Center
  • SCPs
  • IAM Vulnerable Project
  • Stratus Red Team by Datadog
  • CSPM tools
  • Go
  • MITRE ATT&CK
  • AWS IAM

Techniques named here

  • Account manipulation
  • Privilege Escalation via Self-Modification
  • Single Principal Traversal Privilege Escalation
  • Multi-Hop Privilege Escalation
  • CSPM Misconfiguration Detection Scenarios
  • Toxic Combination Misconfigurations
  • Cross-Account Privilege Escalation

Related in Cloud & Infra